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\^ | <POLICY_DOCUMENT title="AS400 Policy For VSM" createDate="2000-05-18" 

' updateDate="2000-08-25" author="Dave Lineman" docType="Policy Document Library" 
docState="System"> ■ 

y-205a 

<POLICY_CATEGORY title="Password Management" orderVaIue="0"> 

<POLICY_STATEMENT identifier="CW_PD_MINLEN" name="Minimum 
,i ■ , Password Length" categoryOrder="0" printFormat="0" 
VJ j ; agentIdentifier="VSM"> 
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<POLICY_STATEMENT_TEXT>The length of passwords must 
always be checked automatically at the time that users construct 
or select them. All passwords must have at least eight (8) 

characters.</POLICY_STATEMENT_TEXT> 

<POLICY_STATEMENT COMMENTARY>In many systems, fixed 
passwords are the first and only line of defense. Although it's a 
long-established hacker technique, guessing fixed passwords 
remains a popular and often successful attack method by which 
unauthorized persons gain system access. In the past hackers used 
manual methods, but these days password guessing is most often 
performed with automated tools like dictionary attack programs 
(so-called 'crack' programs). For related comments, see the 
policies entitled "Anonymous User-IDs," "Limit On Consecutive 
Unsuccessful Attempts To Enter A Password," "Maximum 
Permissible Password Attempts For Dial-Up Users," "Disclosure 
Of Information In System Log-in Banner," and "Requirement 
For Different Passwords On Different 
Systems."</POLICY_STATEMENT_COMMENTARY> 

<POLICY_STATEMENT_EXAMPLE> After a certain number of 
days, the accounting system will require you to choose a new 
password. In order to maximize security, you will be required to 
use at least 8 characters. It is best not to use dictionary names or 

_ other easily-guessed words. /POLICY_STATEMENT_EXAMPLE> 

<POLICY_STATEMENT_RELATIONSHIP 

policyStatementIdentifier="CW_PD_USRIDANN/> 
<POLICY_STATEMENT_RELATIONSHIP 

policyStatementIdentifier="CW_PD_ATTEMPTLOGIN"> 
<POLICY_STATEMENT_RELATIONSHIP 

policyStatementIdentifier="CW_PD_LOGNPRELOGNBNNR"/> 
<POLICY_STATEMENT_RELATIONSHIP 

policyStatementIdentifier="CW_PD_USRTOANON"£> 
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<POLI C YATTRIBUTE name="Audience"> 
<POLICY_ATTRIBUTE_VALUE name="Technical" /> 

</POLICY_ATTRIBUTE> 

<POLICY_ATTRIBUTEname="Environment"> 
<POLICY_ATTRIBUTE_VALUE name="Low Security" t> 
<POLICY_ATTRIBUTE_VALUE name="Medium Security" l> 
<POLICY_ATTRIBUTE_VALUE name="High Security" l> 

</POLICY_ATTRIBUTE> 

<POLICY_PARAMETER name-'TSWRDMINLEN" type="characters" 
value="8" l> 



O 
csi 

CNJ 



<PLATFORM_ACTION platformType="AS400" title=" Audit 
Minimum Length of Passwords'^ 

r <PLATFORM_ACTION_TYPE>audit_auto</PLATFORM_ACT 
ION TYPE> 



CNJ 
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<PLATFORM_ACTION_DESCRIPTION>For AS400 this audit 
specifies the minimum number of characters in a password. 
The risk is that passwords that are common names/words 
are too short and/or have simple patterns are much easier to 
guess and are therefore weak. If QPWDMINLEN is set to 4 
or less, there is a greater chance that someone will guess the 
password or watch a password being entered. The remedy is 
that QPWDMINLEN should be set to 5 or 
greater.</PLATFORM_ACTION_DESCRIPTION> 



<ACTION_PARAMETERname="GTSCMNPWDL" 

dataType="characters" classification-'value" orderlndex-T' 
score="10"> 

i<ACTION_PARAMETER_VALUE>8</ACTION_PARAMETER_ 
!___YALUE> 



<ZA.CTION_PARAMETER> 
I _ <^LATFORM_ACTION> 
_ <yPOLICY_STATEMENT> /** End if Policy Statement **/ 
I. </POLICY_CATEGORY> /** End of Policy Category **/ 
<SUPPORTED_LANGUAGE name="English" l> 



L _ _<VPOLICY_DOCUMENT> /** End of Policy Document **/ 
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Password Construction 

User Chosen Passwords Must Not Be Reused — 322a ^243 

Users must not construct passwords which are identical or substantially similar to 
passwords that they previously employed. 

[ Commentary ) — 326a 
[Brampjes] — 328a 

Cyclical Passwords Prohibited — 322b 224b 

Users are prohibited from constructing fixed passwords by combining a set of 
characters that do not change, with a set of characters that periodically change. 
In these prohibited passwords, characters which change are typically based on 
the month, department, a project, or some other easily-guessed factor. 

[ Commentary] — 326b 
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For example, if your first password was 
"davel 23", you cannot create another 
password called, M davel23" until 13 
passwords have been created. 

Close 



FIG. 10B 



X 

I 



CD 
O 



Q. 
<D 
XI 



o 

p. 



2. 



2, 



0 



CO 
CO 

"D 
< 



0 



x: 

CO 

0) 



a 
o 

CO 



O 



O 

o 

CQ 



o 



8 



(D 



(J 
< 

o 
o 

>- 

o 

d 

Q_ 



-o 

2> o 



1= ^ 



CD 



0 

CO 

O 



CD 

CO 

O 

CO 



n a. 
o -o 

>• (D 

£ n 
o o 

c ^ 
D -O 
P ° 

CD co co 

© ? 

n "D (D 

a => 0 
° o£ 



1* 

o 



CD 



_ D 

D O 

0 0 

w- co 

Q) 

> O 

O n 



.c y y 



c 

0 b 

CO w 
i_ CO 

0 0 

€ 5 

'0 O 

c a 

O "O 

o o 

|S 

a 
o 

0 
0 



0 
co 

_C 

o 
o 

0 

c *= 
g ^= 

a 0 

ii 

S% 

o -j-, 

o ° 
o 3 

=3 o 

o w 
>■ a 



> T W 

§ 2 § 

= n, N 



co 
•t 
O 
Q 
0 



§ 0 

3 2 a 



c 

0 

E 

o 
o 

"D 

o 
a 

b 

O 
i= 
O 

a 
o 



O) 
c 
o 
o 

13 
CT 
_c 
o 
o 

0 

c 
o 

0 
> 

o 



0 

CO 



0 
O 
C 

a 

E 
o 
o 

0 
*> 
O 

13 

o = 

CO 

-t 
O 
Q 
0 

> 



c . 
o 



o 
E 

b 

c 

0 

*> 

o 



o 
o 
0 
c 
o 

CO 

0 



0 
^ O 

£ "O 
O "U 
c 
o 



CO 

o 



Q Q 



0 

M 

G 



o 
E 
E 

=3 



o 

CO 
CM 




13 

o 



c 

0 
"D 

O 
c 



D 
O 
0 
co 



co O 

CO 



O 
D 



2 
0 
"O 



o 
o 

CO 



"O 

Bo 

D ° 
c 

D O 
t£ O 

o — 
a 5 
0 o 

o ^ 



c 
±z 
O 
Q 
0 

c 

0 
"D 

O 
c 



D 
O 
0 
CO 



a 

CD 

c o 

0 Q 
"O 13 

c 



0 



0 



o 

Q 

"D 
C 

o 



9- 0 

<D "O 
C 'O 

0 .£ 



0 



. -4 




CO 



CD 



r 



o 
o 



u_| 



0 



CO 



CO 



o 



UJ 



o 
a 
o 

> 



0 

o 
c 
o 



o 

o 



I 

O 

i 

Q_ 

g 



CO 



uj 

CO 



CO OO ' — i — 
i — i — CO O 

I I I I 

i^. co 
o o o o 

I I I I 

o o o o 
o o o o 

CM CM CM CM 



E 
© 



c 
o 



O > w C 

w D 0 t 

© P c O 

:> © O c 

> Zj 



O 

CO 



£ 0 

CO GO O 



% 

o 

to 



> 
D 

CO 



.Q 
O 
13 



C 

o 
E 

c 



CN 
LO 
CN 



s 



C 

CD 

E 

O 

o 

"O 

o 
a 

0 



O) 
c 

t> 
a 
o 

X3 
0 
G) 
"D 
0 

£ 
O 
c 

o 
o 

0 



£2 =J 
0 < 

CO . . 

0 §■ 

$ O 
£0 



0 



o 



q 2 



CO 



8 



0 



CD 
O 



(D 



o 
a 
o 



CD 
O 
c 
.g 

a 

E 
o 

o 



O 

D_ 
LU 

a 

LU 
CO 



3 § 

5 © 

O w 

CO ^> 



o o 

o £ 
CD 



o 

.i 
E 

o 
CD 



► 

LU 

a 



2 
< 



CO 

► 



CO 



\0 g< 

o; x x x x csj x 



^ x x x °: i x 



X X X X > X X 



.Q .Q .Q .Q .Q .Q .0. 

o o o o o o o 
q. o_ o_ o_ o_ o_ a. 



E 
0 
sz 



c 

D 



c c 
D D 



c (D? 0) 0) 
> o: -) _i w _i _j 



4= -P <D CD 0 

8 g € o $ B 5 



O 

CO 



> 

D 

CO 



n 
o 
.q 



c 

D 

E 

0 
C 





c 


c 




o 


D 




E 


E 




0 


0 


0 


C 


c 


0 


t5 





M 

a 

CD 
c 

c 

o 

c 
CD 

E 

D 

O 

o 

"O 

o 
a 

CD 



O) 
c 

O 
Q) 

"O 
CD 
O) 
"O 

a) 
o 

c 
o 

D 

0 
> 
D 
iZ 
co ■ 
0 < 

CO . . 

D co 



0—" CO 
8? 



CO 

0 O 

0 




c 
o 

to 



o 

CD 



CD 

H — 

O 

a 
E 

Q. 

O 
(D 
JZ 

O 

ZJ 
O 
0 
CO 



>1 

u 

-H 
rH 

o 



o 
-p 
o 

w 

0) 

u 
u 

< 



E 

D 

(D O 

D Q. 

Q-'o 

u CO 

m © 



03 
<D 

a 

(0 

(D 

,3 
4-> 
-H 

(D 
-H 
4-1 
-H 
TJ 
O 
g 

u 

<U 

u 
>1 

u 

-H 
iH 
O 



CO 

c 
o 



Q) 

co 



CO 

O 
C 



o 
o 

< 



c 

0 

■o 

O 

CO 
CO 

o 
a 

£ 

ZD 

E 
c 



E 
E 

"c -C 



"O 

o 

CO 
CO 

o 
a 



E 

0 



O 
D 
0 

CO 

© o 

CO 

_^ 
O 



0 

o 

CO 



O 
v — 

o 

0 
E 

C 



C 

c 
O 

o 

"to 



0 















0 




o 




0 




Q 

X 

iij 


00 



o 

0 
Q 

CO 




c 
o 

c 
O) 



c 

o 
<2 c 

§8 

(O (_) 

C *= 

a> o 



c 

o 
o 
E 
o 

M — 

c 
c 

o 
c 5 
0)05 

w £ O 
>* R 0 

Q O tO 

« E E 

Q j =3 



C 

"B.-D 



E 
© 

o 
c 
O 

§>! 

w C 
X X 

D D 



lei 



c 

0) 

o 

to 

£ 

E 
c 



E 
g 

CD 

2 

CI to 



o o 

a? 

pd! 
^ 3 §■ 

CO » V-/ 

D <D CD 
o_ o: c: 



c 
p 

o 

o 
> 



to 
CD 

£ O 
D) O 
"O O 

^5 

"5 to 

0 O 

55 8 <M 



to 
C 
O 



o 

e-co 

0 0) 
O O 
P P 



to CO 

0 0 



o: cr 



> 

a 
a 
< 



0 

a 
c 
D 

o 



o 



CO 

< 

0 
> 

o 

co 



< 

LO 

O 



O 

o 



c 
o 
c 

E 

< 

LU 
CO 
Q_ 

0 

o 

s 

3 



CM 

5 



o 
5" 



I 



a 

0 
X 



10 

o 
o 



0 
o 

CO 

c 



D) 
c 

3 



Q 

o 
0 

> 



c 

Q) 
c 
O 

o 



CNJ 



E 
o 
o 

CD 



E E 

o o 

o o 

D O O 

CO CO CO 

o o o 

C C C 

CD 0 <D 

a a a 



CD 

GO 

i 



a) _ 
& cd > 

.>< OO 



HI LH HI 



oo oo oo 

^ ^ 

o o o 
o o o 

CM OJ CM 



00 00 oo 
5 ^ ^ 

o o o 
o o o 

CN CM CM 
1= t t 

a a a 

D =3 3 

O O O 
0 0 0 
r r ii 

u o o 



_ D _ 

o a) 8 



CD £ 

X CO 
C |— 



a a a 



r 



< 

o 
o 

LO 



CD 
O) 

O 

c 

O 



O 

CO 



o 

CD 



> 



a 
a 



CD 



0 



c 
CD 

o 

CO 

c 



20 



0 



CD 

a cd 



55 



CO 

C 

*o 

E 
o 
a 

i 

C 



i 

0 

CO 
CO 

5 "D 



2 £ 



> 0 

0 £ 

<o 0 

X CO 

C tz 



a 

O 



<<<<<<<<:> 



5? 



0 



OS 



& 

0 

c: 

a 

E 
o 
0 
x: 

O 



CN 

CO 

to 



< 

co 



0 



zt 



- ^ 

CD « 



CD 



t t t t 



0 CO Tl CO 

is8 



0 a a 
© o o 

^00 

t= _c jz 
2 O O 



a a 
o o 

0 0 
-C JC 

a o 



< < < ^^^^ 



> > * 



8 



a- 



O O 
0 0 

CO CO 



O 
0 

CO CO 



< < < < 



> > V > 



CO 



o 

CM 
LO 



O 
CO 
LO 



I 

T 



X 



p 

0 
Q 



O 



CO 

> 



c 
O 
O 

CO 
CO 

0 
O 

3 



o 

CO 



I 

CO 



c 

— 
Q_ 



n 

CO 

<D 
ID 

E 

CD 



c 
O 

CO 

_C 

a 
o 

CD 
a 

=3 

o 
CD 
O 



c 
O 

Ui 

n 
a 
o 

0 
a 

9 
0 

® 



GO 
> 



o 

c 
O 

O 

CO 
CO 

CD 
O 



0 
O) 
c 

g 

0 
C 



"O 
0 



a 
z> 
o 



^ CD 



"O 
O 



a 

o 
0 
n 

U 
>- 



u 

Q_ 
> 
>- 



o 
o 
oo 



o 
o 
o 



o a; 

S o 
o 

CO 



o 
o 

CM 



CO 

CO 



CD 



CO 

o § 

C CD 
<r CO 



x 0) 
"c £ 

CO 



CO 



X 
I 



> 

2. 



00 

o 
o 
to 



c 
O 
O 

to 

CO 

0 
O 

2 



ZJ 

< 

S 



0 



£) 



(§3 



a 

D 
O 

0 



0 

O 
Q 

c 
o 

O) 

o 



to 
Q 



to 
D 

O 
CO 



0 

E 
o 



0 

E 
o 



0 
to 



2 

CO 



O 

LO 



c c c c c 

"O "O "D "D "D 
0 0 0 0 0 ;r 
O) D) O) O) 0)§ 
O) O) O) O) O) r\j 

p o o o 

^^ 0 0 0 ^0) 
r^- 0 0 0 0 0 cn 

O Z Z Z Z Z r- 



o 
o 
o 

CM 



"D 

0 

o 

c 



0 
£) 

O 
to 

a 



■Q "D "D "D "D 

0 0 0 0 0 

.Q n n n n 

o o o o o 

c c c c c 



0 0 

E o £ 

co Q ^ 




© 

CO 



0) 

n 
o 
c 



CM 
LO 
LO 



© 
CO 

0) 
O 

CO 

b 



© 

CO 

=> 

© 

© 
Q 



p b 
S b s 

© P 2 

o iS 5 



O O O DODO 

cc C c: ci c" c" 

X X X X >< X X 

O O O O O O O 

.o. id n n n n r> 



2 2 2 2 2 2 2 
u u u u u u u 




CO 



CO 



